https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:47:25 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:54371 <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-libs, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm, AlmaLinux:8: v8-13.6-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-libs, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm, AlmaLinux:8: v8-13.6-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:54371 https://cve.radiocsirt.org/vuln/bell-cve-2026-11822 <p><strong>Affected:</strong> Alpaquita:stream: sqlite, BellSoft Hardened Containers:stream: sqlite</p> <p><strong>Affected:</strong> Alpaquita:stream: sqlite, BellSoft Hardened Containers:stream: sqlite</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-11822 https://cve.radiocsirt.org/vuln/bit-sqlite-2026-11822 <p><strong>Affected:</strong> Bitnami: sqlite</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> <p><strong>Affected:</strong> Bitnami: sqlite</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> https://cve.radiocsirt.org/vuln/bit-sqlite-2026-11822 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0753 certfr-2026-avi-0753 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0753 https://cve.radiocsirt.org/vuln/euvd-2026-336522 EUVD-2026-336522 https://cve.radiocsirt.org/vuln/euvd-2026-336522 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11822 <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11822 https://cve.radiocsirt.org/vuln/ghsa-6qj8-gw6p-hc5p <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> https://cve.radiocsirt.org/vuln/ghsa-6qj8-gw6p-hc5p https://cve.radiocsirt.org/vuln/msrc_cve-2026-11822 msrc_CVE-2026-11822 https://cve.radiocsirt.org/vuln/msrc_cve-2026-11822 https://cve.radiocsirt.org/vuln/oesa-2026-2755 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: sqlite, openEuler:22.03-LTS-SP4: sqlite, openEuler:24.03-LTS-SP1: sqlite, openEuler:24.03-LTS-SP3: sqlite</p> <p>SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools. Security Fix(es):</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.(CVE-2026-11822)</p> <p>SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications com…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: sqlite, openEuler:22.03-LTS-SP4: sqlite, openEuler:24.03-LTS-SP1: sqlite, openEuler:24.03-LTS-SP3: sqlite</p> <p>SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools. Security Fix(es):</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.(CVE-2026-11822)</p> <p>SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications com…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2755 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11059-1 <p>lemon-3.53.2-2.1 on GA media</p> <p>lemon-3.53.2-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11059-1 https://cve.radiocsirt.org/vuln/rhsa-2026:45779 <p>sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 sqlite: SQLite: Denial of Service via use-after-free in JSON extraction</p> <p>sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 sqlite: SQLite: Denial of Service via use-after-free in JSON extraction</p> https://cve.radiocsirt.org/vuln/rhsa-2026:45779 https://cve.radiocsirt.org/vuln/rlsa-2026:54371 <p><strong>Affected:</strong> Rocky Linux:8: nodejs, Rocky Linux:8: nodejs-nodemon, Rocky Linux:8: nodejs-packaging</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)</p> <p>* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)</p> <p>* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)</p> <p>* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)</p> <p>* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)</p> <p>* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: nodejs, Rocky Linux:8: nodejs-nodemon, Rocky Linux:8: nodejs-packaging</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)</p> <p>* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)</p> <p>* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)</p> <p>* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)</p> <p>* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)</p> <p>* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:54371 https://cve.radiocsirt.org/vuln/suse-su-2026:22104-1 <p>Security update for sqlite3</p> <p>Security update for sqlite3</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22104-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11822 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: sqlite, Ubuntu:Pro:14.04:LTS: sqlite3, Ubuntu:Pro:16.04:LTS: sqlite3, Ubuntu:16.04:LTS: sqlite, Ubuntu:Pro:18.04:LTS: sqlite3, Ubuntu:18.04:LTS: sqlite, Ubuntu:Pro:20.04:LTS: sqlite3, Ubuntu:20.04:LTS: sqlite, Ubuntu:22.04:LTS: sqlite, Ubuntu:22.04:LTS: sqlite3 and 3 more</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: sqlite, Ubuntu:Pro:14.04:LTS: sqlite3, Ubuntu:Pro:16.04:LTS: sqlite3, Ubuntu:16.04:LTS: sqlite, Ubuntu:Pro:18.04:LTS: sqlite3, Ubuntu:18.04:LTS: sqlite, Ubuntu:Pro:20.04:LTS: sqlite3, Ubuntu:20.04:LTS: sqlite, Ubuntu:22.04:LTS: sqlite, Ubuntu:22.04:LTS: sqlite3 and 3 more</p> <p>SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11822 https://cve.radiocsirt.org/vuln/vde-2026-088 <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> https://cve.radiocsirt.org/vuln/vde-2026-088 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2816 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um SSRF-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, möglicherweise beliebigen Code auszuführen oder einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um SSRF-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, möglicherweise beliebigen Code auszuführen oder einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2816